linux-kernel - [tip:x86/pti] x86/events/intel/ds: Fix bts_interrupt

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tip-2c991e408df6a407476dbc453d725e1e975479e7@git.kernel.org>
Date:   Sun, 15 Jul 2018 02:42:59 -0700
From:   tip-bot for Hugh Dickins <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     mingo@...nel.org, hpa@...or.com, markus.t.metzger@...el.com,
        dave.hansen@...el.com, linux-kernel@...r.kernel.org,
        acme@...nel.org, eranian@...gle.com, alexander.shishkin@...el.com,
        andi.kleen@...el.com, hughd@...gle.com, tglx@...utronix.de,
        peterz@...radead.org
Subject: [tip:x86/pti] x86/events/intel/ds: Fix bts_interrupt_threshold
 alignment

Commit-ID:  2c991e408df6a407476dbc453d725e1e975479e7
Gitweb:     https://git.kernel.org/tip/2c991e408df6a407476dbc453d725e1e975479e7
Author:     Hugh Dickins <hughd@...gle.com>
AuthorDate: Sat, 14 Jul 2018 12:58:07 -0700
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Sun, 15 Jul 2018 11:38:44 +0200

x86/events/intel/ds: Fix bts_interrupt_threshold alignment

Markus reported that BTS is sporadically missing the tail of the trace
in the perf_event data buffer: [decode error (1): instruction overflow]
shown in GDB; and bisected it to the conversion of debug_store to PTI.

A little "optimization" crept into alloc_bts_buffer(), which mistakenly
placed bts_interrupt_threshold away from the 24-byte record boundary.
Intel SDM Vol 3B 17.4.9 says "This address must point to an offset from
the BTS buffer base that is a multiple of the BTS record size."

Revert "max" from a byte count to a record count, to calculate the
bts_interrupt_threshold correctly: which turns out to fix problem seen.

Fixes: c1961a4631da ("x86/events/intel/ds: Map debug buffers in cpu_entry_area")
Reported-and-tested-by: Markus T Metzger <markus.t.metzger@...el.com>
Signed-off-by: Hugh Dickins <hughd@...gle.com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Arnaldo Carvalho de Melo <acme@...nel.org>
Cc: Alexander Shishkin <alexander.shishkin@...el.com>
Cc: Andi Kleen <andi.kleen@...el.com>
Cc: Dave Hansen <dave.hansen@...el.com>
Cc: Stephane Eranian <eranian@...gle.com>
Cc: stable@...r.kernel.org # v4.14+
Link: https://lkml.kernel.org/r/alpine.LSU.2.11.1807141248290.1614@eggly.anvils

---
 arch/x86/events/intel/ds.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/arch/x86/events/intel/ds.c b/arch/x86/events/intel/ds.c
index 8a10a045b57b..8cf03f101938 100644
--- a/arch/x86/events/intel/ds.c
+++ b/arch/x86/events/intel/ds.c
@@ -408,9 +408,11 @@ static int alloc_bts_buffer(int cpu)
 	ds->bts_buffer_base = (unsigned long) cea;
 	ds_update_cea(cea, buffer, BTS_BUFFER_SIZE, PAGE_KERNEL);
 	ds->bts_index = ds->bts_buffer_base;
-	max = BTS_RECORD_SIZE * (BTS_BUFFER_SIZE / BTS_RECORD_SIZE);
-	ds->bts_absolute_maximum = ds->bts_buffer_base + max;
-	ds->bts_interrupt_threshold = ds->bts_absolute_maximum - (max / 16);
+	max = BTS_BUFFER_SIZE / BTS_RECORD_SIZE;
+	ds->bts_absolute_maximum = ds->bts_buffer_base +
+					max * BTS_RECORD_SIZE;
+	ds->bts_interrupt_threshold = ds->bts_absolute_maximum -
+					(max / 16) * BTS_RECORD_SIZE;
 	return 0;
 }